Listen 443 https

SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout  300
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin

<VirtualHost _default_:443>

  ServerName {{ servername }}:443
  ErrorLog logs/ssl_error_log
  TransferLog logs/ssl_access_log
  LogLevel warn

  SSLEngine on
  SSLProtocol all -SSLv2
  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
  SSLCertificateFile /etc/pki/tls/certs/{{ apache_ssl_cert }}
  SSLCertificateKeyFile /etc/pki/tls/private/{{ apache_ssl_key }}
  SSLCertificateChainFile /etc/pki/tls/certs/{{ apache_ssl_interm }}

  <Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
  </Files>
  <Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
  </Directory>

  CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

  # custom error document when Glassfish isn't responding
  ErrorDocument 503 /503.html
  ProxyPassMatch ^/503.html$ !

  # don't pass paths used by rApache and TwoRavens to Glassfish
  ProxyPassMatch ^/RApacheInfo$ !
  ProxyPassMatch ^/custom !
  ProxyPassMatch ^/dataexplore !

  # don't pass paths used by Shibboleth to Glassfish
  ProxyPassMatch ^/Shibboleth.sso !
  ProxyPassMatch ^/shibboleth-ds !

  # allow munin
  ProxyPassMatch ^/munin !

  # pass everything else to Glassfish
  ProxyPass / ajp://localhost:8009/

#  <Location /shib.xhtml>
#    AuthType shibboleth
#    ShibRequestSetting requireSession 1
#    require valid-user
#  </Location>

</VirtualHost>                                  
